Deep Learning Regressors for Quantitative Steganalysis · UED-JC Q75 Figure 3. True vs. estimated payload for the bucket regressor. Upper left WOW, right S-UNIWARD. Bottom left: J-UNIWARD,

Deep Learning Regressors for Quantitative SteganalysisMo Chen, Mehdi Boroumand, and Jessica Fridrich, Department of ECE, SUNY Binghamton, NY, USA, [email protected],{mboroum1, fridrich}@binghamton.edu

AbstractThe goal of quantitative steganalysis is to provide an

estimate of the size of the embedded message once an imagehas been detected as containing secret data. For stegano-graphic algorithms free of serious design flaws, such asschemes based on least significant bit replacement, the mostcompetitive quantitative detectors have traditionally beenbuilt as regressors in rich media models. Considering therecent advances in binary steganalysis due to deep learning,in this paper we use the features extracted from the activa-tion of such CNN detectors for the task of payload esti-mation. The merit of the proposed architecture is demon-strated experimentally on steganographic algorithms oper-ating both in the spatial and JPEG domain.

IntroductionSteganography is the art of communicating secret mes-

sages to another party by hiding the secrets in cover objectsso that an adversary monitoring the traffic cannot distin-guish between genuine cover objects and objects carryingsecret data. Formally, steganography is considered brokenwhen the mere presence of the secret can be established.Forensic analysts, however, are likely to benefit from ac-cessing additional information, such as what algorithm wasused to hide the secret and how long the message is. Whilesteganalysis can be formulated as a binary hypothesis test,determining the payload size is an estimation problem. Al-though the output of a binary classifier could be mapped toan approximate payload size, such estimators are rarely thebest. Conversely, the output of a quantitative steganalyzeris not necessarily the best test statistic [23].

The objective of quantitative steganalysis is to esti-mate the number of embedding changes, which can berelated to the message length after taking into consider-ation the source coding applied during embedding [10].Historically, the first accurate detectors of Least Signifi-cant Bit (LSB) replacement were quantitative detectors,such as RS analysis [12], Sample Pairs analysis (SPA) [9],Triples analysis [18], and the Weighted-Stego (WS) de-tector [11, 19, 6, 33]. These so-called structural attacksare fundamentally possible because of the fixed polarity ofchanges imposed by LSB replacement. In this case, de-tection of stego signal applied to all pixels amounts to de-tecting a known deterministic signal, which facilitates con-struction of very accurate detectors and payload estima-tors. This is because flipping the LSB changes the pixelmean while the embedding operation of LSB matching(also known as ±1 embedding) changes the variance whilepreserving the pixel mean, which makes it much harder todetect. Structural quantitative detectors are thus funda-

mentally limited and do not generalize to embedding basedon LSB matching.

An alternative and general approach to quantitativesteganalysis was proposed in [24] by formulating the prob-lem of message-length estimation as a regression in a suit-ably chosen representation of images (feature space). Aquantitative steganalyzer constructed in this way can bebuilt for an arbitrary embedding method, and its perfor-mance generally depends on how sensitive the features areto embedding and how detectable the embedding is usingbinary classifiers. The price for such flexibility is the needfor a training phase in which the regressor is presented withsamples of features extracted from a database of stego im-ages embedded with a range of payloads. The same papershowed the benefit of using non-linear regressors, whichwere implemented using support vector regression. Thecomplexity of training such regressors limited the dimen-sionality of the feature space one could use to build thepayload size estimator. To permit the utilization of morecomplex and high-dimensional image descriptors called richmedia models [13, 20, 4, 28, 8, 16, 27, 7], the authors of [21]proposed a variant of a regression tree modified to reflectthe specifics of steganalysis and approximate the regressionfunction by a generalized additive model while improvingthe quality of the fit sequentially in a gradient-descent man-ner.

Recently, novel steganalysis detector architectures im-plemented within the paradigm of deep Convolutional Neu-ral Networks (CNN) have been proposed. The first ar-chitecture with respectable performance employed Gaus-sian activation function and a high-pass preprocessinglayer [25, 26]. The architecture proposed by Xu etal. [31, 30] (XuNet) designed for steganalysis of spatial do-main embedding algorithms achieved performance compa-rable to classical steganalysis with rich media models andthe ensemble classifier [22]. A markedly better detection ofspatial-domain steganography was recently achieved withan eight-layer network called the YeNet [32], which con-stitutes the current state of the art to the best knowl-edge of the authors (as of December 2017). For JPEGsteganalysis, two recently proposed architectures showed aperformance improvement over steganalysis with selection-channel-aware Gabor Filter Residuals (GFR) [7]: XuNetmade aware of JPEG phase [5] and the deep architec-ture with shortcut connections [29] proposed to detect J-UNIWARD [17].

In this paper, we adapt deep learning for quantitativesteganalysis in both spatial and JPEG domains. Our de-sign, which we call the “bucket estimator,” starts by firsttraining a family of CNN detectors, each for a different

1

Figure 1. Example of dataset preparation and training for J-UNIWARD with quality factor 75.

fixed payload, and then using their concatenated featuremaps as a feature on which a fully-connected network (re-gressor) is trained by using the Mean Square Error (MSE)as the loss function. This design came out as the bestperformer among other natural choices. Experiments withtwo steganographic algorithms in each domain are used toshow the merit of the proposed idea.

Bucket estimatorThe most natural way to convert a binary classifier

built as a CNN into a quantitative regressor is to replacethe softmax loss function with the MSE and use the embed-ded payloads as continuous-valued class labels. We haveexperimented with different approaches, such as initializ-ing the net weights with a pre-trained binary classifier, in-cluding multiple stego images with different payloads intothe same mini-batch, adopting other loss functions, includ-ing the relative estimation error, and expanding the fullyconnected part of the regressor with different non-linearactivation functions. Even though we observed some im-provement over the state of the art, the regression trees onrich models [21], we were unable to match the performanceof the bucket estimator described next.

The approach that showed the most promise is basedon first constructing a bucket of k binary CNN detectorsDαi trained on the cover class and the class of stego imagesembedded with a fixed payload αi bpp, i = 1, . . . ,k. Thefeature extraction part of these detectors (the last M ac-tivation features connected to the classifier part, the fullyconnected layers) were then concatenated into a k×M di-mensional feature vector and a payload regressor shown inFigure 2 was trained on such “bucket features” of stegoimages embedded with payloads α chosen uniformly ran-

Figure 2. Three-layer FNN payload regressor used in both stego domains.

α WOW PE S-UNI PE0.1 0.2796 0.34520.2 0.2092 0.26260.3 0.1428 0.18610.4 0.1107 0.13240.5 0.0820 0.09970.6 0.0692 0.0764

Table 1. Detection error PE of individual binary detectors Dαi ,i = 1, . . . ,6, trained for a range of payloads αi for WOW andS-UNIWARD.

2

WOW S-UNIWARDFeatures used MSE MAE MSE MAE

0.1 0.0157 0.1006 0.0156 0.09830.2 0.0143 0.0954 0.0135 0.08960.3 0.0126 0.0882 0.0124 0.08630.4 0.0127 0.0889 0.0121 0.08500.5 0.0121 0.0857 0.0123 0.08580.6 0.0125 0.0871 0.0121 0.0847All 0.0112 0.0816 0.0109 0.0789

Table 2. Performance of FNN regressors when using the featuremaps from one or six payload CNN detectors Dαi for WOW andS-UNIWARD.

Bucket+FNN Bucket+RT SRM+RC+RTEmbedding MSE MAE MSE MAE MSE MAE

WOW .0109 .0789 .0104 .0777 .0151 .0966SUNI .0112 .0816 .0109 .0808 .0145 .0922

Table 3. MSE and MAD of three different regressors for spatialdomain steganography: the bucket regressor, regression tree onbucket regressor features, and regression tree on SRM featurestransformed with random conditioning.

domly from some fixed interval I. The regressor is a three-layer fully connected neural network (FNN) with2kM neu-rons in each layer and an output neuron. This regressoruses batch normalization and the ReLU non-linearity in allnon-output layers.

For spatial domain steganography, the detectors Dαi

were implemented as YeNets without the knowledge ofthe selection channel (TLU CNN in the original publica-tion [32]) because the payload is the unknown parameterto be estimated. The dimensionality of the feature vector– the concatenated feature maps before the classifier in aYeNet – isM = 16×3×3 = 144. Since we selected a bucketof k= 6 detectors trained for αi ∈ {0.1,0.2,0.3,0.4,0.5,0.6}bpp, the resulting feature representation of images had di-mensionality k×M = 6×144 = 864. The image source wasthe BOSSbase 1.01 database [1] downsampled to 256×256using default ’imresize’ in Matlab. A random half of theimages (5000 cover and stego images) were used for trainingthe detectors Dα, where 4,000 pairs were used for trainingand 1,000 pairs for validation. As in [32], downsampled im-ages from BOWS2 [2] (all 10,000 of them) were added tothe training set to prevent the YeNet from overfitting. Outof the remaining 5,000 BOSSbase cover-stego pairs, 3,000of them were used to train the regressor and 2,000 wereused to assess the regressor’s accuracy. The 5,000 stegoimages were each embedded with six payloads randomlychosen from the interval I = [0.05,0.6], making the totalnumber of training and testing images 3,000×6 = 18,000and 12,000, respectively. The regressor was a three-layerfully connected network with 2× 864 = 1,728 neurons ineach layer and an output neuron.

For JPEG steganography, we used the VNet [5]with a bucket of k = 6 detectors for payloads αi ∈{0.1,0.2,0.3,0.4,0.5,0.6} bpnzac (bits per non-zero ACDCT coefficient). The VNet was modified in comparisonto the original publication [5] in the following manner. To

reduce the feature sparsity and decrease the feature di-mensionality of the bucket, the number of features wasreduced from 512 to 256. The resulting feature dimension-ality for training the regressor was thus 6× 256 = 1536.Similarly, the regressor was a three-layer fully connectednetwork with 3,072 neurons in each layer and an outputneuron. The image source was the BOSSbase 1.01 (theoriginal 512×512 images) compressed with quality factors75 and 95 because we could afford to train the VNet forthe original non-resized BOSSbase images. Since the VNetis smaller, it does not benefit from adding BOWS2 imagesas much as YeNet, which is why we only trained on BOSS-base images in contrast to the spatial domain. As in thespatial domain, a random half of BOSSBase images wereused for training each binary classifier Dα with 4,000 pairsfor training and 1,000 pairs for validation. and the other3,000 and 2,000 were used for training and assessing theregressor. The training and testing libraries for the regres-sor were also constructed in a similar way as in the spatialdomain. An example of the dataset preparation and thetraining of the binary classifiers and the regressor is shownschematically in Figure 1 for J-UNIWARD, quality factor75.

The YeNet and VNet were trained with data augmen-tation (random rotation and mirroring applied to images).The training hyperparameters were kept the same as in thecorresponding publications [32, 5] with one exception. Inorder to maximize the feature diversity, when traininingthe binary CNN detector for each payload, the networkswere initialized with different random seeds and all trainedfrom scratch (curriculum training as in [5] and [32] was notused). Additionally, the training and validation sets havebeen split with different random seeds as well.

For the regressor, a simple minibatch stochastic gra-dient descend was used. The momentum and weight decaywere fixed to 0.9 and 0.01, respectively. The learning ratefor all parameters was chosen logarithmically spaced be-tween 10−4 and 10−6 for 100 epochs. The minibatcheswere formed by 150 images with different payloads origi-nating from 25 cover images. In other words, each mini-batch contained 25 subsets of 6 features corresponding tosix stego images, each with a different payload. The convo-lution kernels were initialized with a zero-mean Gaussiandistribution with standard deviation 0.01 and all biaseswere disabled.

ExperimentsThis section reports the results of all experiments.

Two steganographic algorithms were tested in each em-bedding domain. In addition, two JPEG quality factorswere used for JPEG images. Two measures of statisticalspread were used to compare the bucket regressor with re-gression trees with rich models – the MSE and the MeanAbsolute Error (MAE). We note that a trivial estimatorthat always outputs the mean payload from the consideredrange I = [0.05,0.6] has MSE = (0.6− 0.05)2/12 = 0.252and MAE = (0.6−0.05)/4 = 0.138, respectively.

3

0 0.1 0.2 0.3 0.4 0.5 0.6 0.70

0.1

0.2

0.3

0.4

0.5

0.6

0.7

True payload (bpp)

Est

imat

ed p

aylo

ad

WOW

0 0.1 0.2 0.3 0.4 0.5 0.6 0.70

0.1

0.2

0.3

0.4

0.5

0.6

0.7

True payload (bpp)

Est

imat

ed p

aylo

ad

S−UNIWARD

0 0.1 0.2 0.3 0.4 0.5 0.6 0.70

0.1

0.2

0.3

0.4

0.5

0.6

0.7

True payload (bpnzac)

Est

imat

ed p

aylo

ad

JUNI Q75

0 0.1 0.2 0.3 0.4 0.5 0.6 0.70

0.1

0.2

0.3

0.4

0.5

0.6

0.7

True payload (bpnzac)

Est

imat

ed p

aylo

ad

UED−JC Q75

Figure 3. True vs. estimated payload for the bucket regressor. Upper left WOW, right S-UNIWARD. Bottom left: J-UNIWARD, right UED, both qualityfactor 75.

Spatial domainIn the spatial domain, two content-adaptive em-

bedding algorithms were selected for the experiments –WOW [15] and S-UNIWARD [17].

Table 1 shows the performance of six individual de-tectors Dα in terms of the minimal total probability errorunder equal priors1

PE = minPFA

12(PFA +PMD) (1)

for both embedding algorithms. The scatter plot of thebucket payload regressor utilizing the feature maps fromall six detectors is shown in Figure 3 top. Table 2 showsthe gain of the bucket regressor compared to the regressorsbuilt from features of a single binary classifier Dαi . Itshows that using the bucket of features helps decrease theestimation error.

In Table 3, we provide the comparison between thebucket regressor and previous art. The first column showsthe performance of the bucket regressor as described in thistext, the second shows the errors of the regression trees [21]built with features extracted from all individual CNN de-tectors, while the third column contains the performanceof the regression tree trained on SRM features normalizedwith random conditioning (RC) [3]. The bucket regressor

1PFA and PMD are the false-alarm and missed-detectionrates.

enjoys about 30% smaller MSE than regression trees withrandomly conditioned SRM. The FNN regressor performsapproximately the same as the regression tree (the firstversus the second column). We selected the SRM becausethe selection-chanel-aware maxSRM [8] cannot be appliedbecause the payload is not known.

JPEG domainFor JPEG domain, J-UNIWARD [17] and UED-

JC [14] were tested at JPEG quality 75 and 95.Table 4 shows the performance of individual detectors

Dαi in terms of PE for for both algorithms and qualityfactors. The scatter plot of the bucket payload regressorutilizing the feature maps from all six detectors is shown inFigure 3 bottom. Table 5 shows the gain in terms of MSEand MAE of using the bucket features versus the regressortrained only on features from a single binary classifier Dαi .

In Table 6, we compare the performance of the bucketregressor (the first column), the regression tree on featuresused by the bucket regressor (the second column), andthe regression tree implemented with GFR features [27].Again, since the payload is to be estimated, it was not pos-sible to use the selection-channel-aware GFR features [7].

Similar to the spatial domain, the bucket regressorprovides about 30% smaller MSE than regression treestrained with the GFR model. As shown in Tables 6 and3, the FNN regressor on bucket feature maps has a similarperformance as a regression tree on the same features.

4

α JUNI 75 PE JUNI 95 PE UED 75 PE UED 95 PE0.1 0.4040 0.4725 0.2450 0.43400.2 0.2480 0.4285 0.1070 0.30950.3 0.1430 0.3485 0.0550 0.21800.4 0.0795 0.2960 0.0330 0.14800.5 0.0460 0.2125 0.0150 0.08500.6 0.0240 0.1310 0.0080 0.0455

Table 4. Detection error PE of individual detectors trained for a range of payloads for J-UNIWARD and UED-JC.

JUNI 75 JUNI 95 UED 75 UED 95Features used MSE MAE MSE MAE MSE MAE MSE MAE

0.1 0.0124 0.0872 0.0196 0.1145 0.0077 0.0672 0.0201 0.11520.2 0.0096 0.0757 0.0196 0.1148 0.0059 0.0583 0.0154 0.09860.3 0.0090 0.0732 0.0183 0.1089 0.0060 0.0592 0.0139 0.09260.4 0.0085 0.0712 0.0181 0.1096 0.0063 0.0609 0.0125 0.08670.5 0.0088 0.0726 0.0174 0.1068 0.0062 0.0608 0.0120 0.08550.6 0.0090 0.0731 0.0175 0.1071 0.0064 0.0612 0.0116 0.0840All 0.0082 0.0689 0.0165 0.1032 0.0052 0.0549 0.0107 0.0799

Table 5. Performance of CNN regressors when using the feature mapes from one or six payload detectors Dαi for J-UNIWARD andUED-JC and quality factors 75 and 95.

Bucket+FNN Bucket+RT GFR+RTEmbedding MSE MAE MSE MAE MSE MAE

JUNI 75 .0082 .0689 .0080 .0694 .0126 .0883JUNI 95 .0165 .1032 .0160 .1026 .0251 .1247

UED-JC 75 .0052 .0549 .0053 .0556 .0072 .0659UED-JC 95 .0107 .0799 .0100 .0779 .0165 .1011

Table 6. MSE and MAD of three different regressors for twoJPEG embedding algorithms and two quality factors: the bucketregressor, regression tree on bucket regressor features, and re-gression tree on GFR features.

ConclusionsQuantitative steganalysis deals with the problem of

estimating the length of the secret message. In this paper,we propose a new approach to building quantitative ste-ganalyzers (payload estimators) by leveraging the recentprogress in binary steganalysis using deep CNNs. A fam-ily of such binary classifiers is constructed for a range offixed payload sizes. The feature maps outputted by suchnetwork detectors right before the fully-connected classifierpart of the network are concatenated and used as an inputinto a non-linear regressor implemented with a three-layerfully connected network. This “bucket” estimator providesabout 30% reduction in the mean square error of the pay-load estimator when compared with previous art – regres-sion trees on rich media models. This level of improvementwas observed in both the spatial and JPEG domain.

In general, the accuracy of the bucket regressor isstrongly related to the performance of the binary detec-tors. It is to be expected that further advancements in bi-nary steganalysis will lead to corresponding improvementsof payload regressors.

All code used to produce the results in this paper,including the network configuration files are available fromhttp://dde.binghamton.edu/download/.

AcknowledgmentsThe work on this paper was supported by the Air

Force Office of Scientific Research under the research grantFA9950-12-1-0124. The U.S. Government is authorized toreproduce and distribute reprints for Governmental pur-poses notwithstanding any copyright notation there on.The views and conclusions contained herein are those ofthe authors and should not be interpreted as necessarilyrepresenting the official policies, either expressed or im-plied of AFOSR or the U.S. Government.

References[1] P. Bas, T. Filler, and T. Pevný. Break our stegano-

graphic system – the ins and outs of organizing BOSS.In T. Filler, T. Pevný, A. Ker, and S. Craver, edi-tors, Information Hiding, 13th International Confer-ence, volume 6958 of Lecture Notes in Computer Sci-ence, pages 59–70, Prague, Czech Republic, May 18–20, 2011. Springer Berlin Heidelberg.

[2] P. Bas and T. Furon. BOWS-2. http://bows2.ec-lille.fr, July 2007.

[3] M. Boroumand and J. Fridrich. Non-linear fea-ture normalization for steganalysis. In M. Stamm,M. Kirchner, and S. Voloshynovskiy, editors, The 5thACM Workshop on Information Hiding and Multime-dia Security, Philadelphia, PA, June 20–22, 2017.

[4] L. Chen, Y.Q. Shi, P. Sutthiwan, and X. Niu. A novelmapping scheme for steganalysis. In Y.Q. Shi, H.-J. Kim, and F. Perez-Gonzalez, editors, InternationalWorkshop on Digital Forensics and Watermaking, vol-ume 7809 of LNCS, pages 19–33. Springer Berlin Hei-delberg, 2013.

[5] M. Chen, V. Sedighi, M. Boroumand, and J. Fridrich.JPEG-phase-aware convolutional neural network forsteganalysis of JPEG images. In M. Stamm, M. Kirch-ner, and S. Voloshynovskiy, editors, The 5th ACMWorkshop on Information Hiding and Multimedia Se-

5

curity, Philadelphia, PA, June 20–22, 2017.[6] R. Cogranne, C. Zitzmann, L. Fillatre, F. Retraint,

I. Nikiforov, and P. Cornu. A cover image model forreliable steganalysis. In T. Filler, T. Pevný, A. Ker,and S. Craver, editors, Information Hiding, 13th In-ternational Conference, Lecture Notes in ComputerScience, pages 178–192, Prague, Czech Republic, May18–20, 2011.

[7] T. Denemark, M. Boroumand, and J. Fridrich.Steganalysis features for content-adaptive JPEGsteganography. IEEE Transactions on Informa-tion Forensics and Security, 11(8):1736–1746, August2016.

[8] T. Denemark, V. Sedighi, V. Holub, R. Cogranne, andJ. Fridrich. Selection-channel-aware rich model forsteganalysis of digital images. In IEEE InternationalWorkshop on Information Forensics and Security, At-lanta, GA, December 3–5, 2014.

[9] S. Dumitrescu, X. Wu, and Z. Wang. Detection of LSBsteganography via Sample Pairs Analysis. In F. A. P.Petitcolas, editor, Information Hiding, 5th Interna-tional Workshop, volume 2578 of Lecture Notes inComputer Science, pages 355–372, Noordwijkerhout,The Netherlands, October 7–9, 2002. Springer-Verlag,New York.

[10] T. Filler, J. Judas, and J. Fridrich. Minimizing ad-ditive distortion in steganography using syndrome-trellis codes. IEEE Transactions on InformationForensics and Security, 6(3):920–935, September2011.

[11] J. Fridrich and M. Goljan. On estimation of secretmessage length in LSB steganography in spatial do-main. In E. J. Delp and P. W. Wong, editors, Proceed-ings SPIE, Electronic Imaging, Security, Steganogra-phy, and Watermarking of Multimedia Contents VI,volume 5306, pages 23–34, San Jose, CA, January 19–22, 2004.

[12] J. Fridrich, M. Goljan, and R. Du. Detecting LSBsteganography in color and gray-scale images. IEEEMultimedia, Special Issue on Security, 8(4):22–28,October–December 2001.

[13] J. Fridrich and J. Kodovský. Rich models for steganal-ysis of digital images. IEEE Transactions on Informa-tion Forensics and Security, 7(3):868–882, June 2011.

[14] L. Guo, J. Ni, and Y. Q. Shi. Uniform embeddingfor efficient JPEG steganography. IEEE Transactionson Information Forensics and Security, 9(5):814–825,May 2014.

[15] V. Holub and J. Fridrich. Designing steganographicdistortion using directional filters. In Fourth IEEEInternational Workshop on Information Forensics andSecurity, Tenerife, Spain, December 2–5, 2012.

[16] V. Holub and J. Fridrich. Phase-aware projectionmodel for steganalysis of JPEG images. In A. Alattarand N. D. Memon, editors, Proceedings SPIE, Elec-tronic Imaging, Media Watermarking, Security, andForensics 2015, volume 9409, pages 0T 1–11, SanFrancisco, CA, February 8–12, 2015.

[17] V. Holub, J. Fridrich, and T. Denemark. Universal

distortion design for steganography in an arbitrarydomain. EURASIP Journal on Information Security,Special Issue on Revised Selected Papers of the 1stACM IH and MMS Workshop, 2014:1, 2014.

[18] A. D. Ker. A general framework for structural anal-ysis of LSB replacement. In M. Barni, J. Herrera,S. Katzenbeisser, and F. Pérez-González, editors, In-formation Hiding, 7th International Workshop, vol-ume 3727 of Lecture Notes in Computer Science, pages296–311, Barcelona, Spain, June 6–8, 2005. Springer-Verlag, Berlin.

[19] A. D. Ker and R. Böhme. Revisiting weightedstego-image steganalysis. In E. J. Delp, P. W.Wong, J. Dittmann, and N. D. Memon, editors, Pro-ceedings SPIE, Electronic Imaging, Security, Foren-sics, Steganography, and Watermarking of MultimediaContents X, volume 6819, pages 5 1–17, San Jose, CA,January 27–31, 2008.

[20] J. Kodovský and J. Fridrich. Steganalysis of JPEG im-ages using rich models. In A. Alattar, N. D. Memon,and E. J. Delp, editors, Proceedings SPIE, ElectronicImaging, Media Watermarking, Security, and Foren-sics 2012, volume 8303, pages 0A 1–13, San Francisco,CA, January 23–26, 2012.

[21] J. Kodovský and J. Fridrich. Quantitative steganalysisusing rich models. In A. Alattar, N. D. Memon, andC. Heitzenrater, editors, Proceedings SPIE, ElectronicImaging, Media Watermarking, Security, and Foren-sics 2013, volume 8665, pages 0O 1–11, San Francisco,CA, February 5–7, 2013.

[22] J. Kodovský, J. Fridrich, and V. Holub. Ensembleclassifiers for steganalysis of digital media. IEEETransactions on Information Forensics and Security,7(2):432–444, 2012.

[23] T. Pevný. Detecting messages of unknown length.In A. Alattar, N. D. Memon, E. J. Delp, andJ. Dittmann, editors, Proceedings SPIE, ElectronicImaging, Media Watermarking, Security and Foren-sics III, volume 7880, pages OT 1–12, San Francisco,CA, January 23–26, 2011.

[24] T. Pevný, J. Fridrich, and A. D. Ker. From blind toquantitative steganalysis. IEEE Transactions on In-formation Forensics and Security, 7(2):445–454, 2011.

[25] Y. Qian, J. Dong, W. Wang, and T. Tan. Deep learn-ing for steganalysis via convolutional neural networks.In A. Alattar and N. D. Memon, editors, ProceedingsSPIE, Electronic Imaging, Media Watermarking, Se-curity, and Forensics 2015, volume 9409, pages 0J 1–10, San Francisco, CA, February 8–12, 2015.

[26] Y. Qian, J. Dong, W. Wang, and T. Tan. Learningand transferring representations for image steganaly-sis using convolutional neural network. In IEEE In-ternational Conference on Image Processing (ICIP),pages 2752–2756, September 25–28, 2016.

[27] X. Song, F. Liu, C. Yang, X. Luo, and Y. Zhang.Steganalysis of adaptive JPEG steganography using2D Gabor filters. In A. Alattar, J. Fridrich, N. Smith,and P. Comesana Alfaro, editors, The 3rd ACM Work-shop on Information Hiding and Multimedia Security,

6

IH&MMSec ’15, Portland, OR, June 17–19, 2015.[28] W. Tang, H. Li, W. Luo, and J. Huang. Adaptive

steganalysis against WOW embedding algorithm. InS. Katzenbeisser, R. Kwitt, and A. Piva, editors, The2nd ACM Workshop on Information Hiding and Mul-timedia Security, pages 91–96, Salzburg, Austria, June11–13, 2014.

[29] G. Xu. Deep convolutional neural network to de-tect J-UNIWARD. In M. Stamm, M. Kirchner,and S. Voloshynovskiy, editors, The 5th ACM Work-shop on Information Hiding and Multimedia Security,Philadelphia, PA, June 20–22, 2017.

[30] G. Xu, H.-Z. Wu, and Y. Q. Shi. Ensemble of CNNsfor steganalysis: An empirical study. In F. Perez-Gonzales, F. Cayre, and P. Bas, editors, The 4th ACMWorkshop on Information Hiding and Multimedia Se-curity, IH&MMSec ’16, pages 5–10, Vigo, Spain, June20–22, 2016.

[31] G. Xu, H. Z. Wu, and Y. Q. Shi. Structural design ofconvolutional neural networks for steganalysis. IEEESignal Processing Letters, 23(5):708–712, May 2016.

[32] J. Ye, J. Ni, and Y. Yi. Deep learning hierar-chical representations for image steganalysis. IEEETransactions on Information Forensics and Security,12(11):2545–2557, November 2017.

[33] C. Zitzmann, R. Cogranne, F. Retraint, I. Nikiforov,L. Fillatre, and P. Cornu. Statistical decision meth-ods in hidden information detection. In T. Filler,T. Pevný, A. Ker, and S. Craver, editors, Informa-tion Hiding, 13th International Conference, LectureNotes in Computer Science, pages 163–177, Prague,Czech Republic, May 18–20, 2011.

Author BiographyMo Chen received the BS and MS degrees in Electrical

Engineering from Shandong University, China, in 1998 and2001 and the Ph.D. in Electrical Engineering from Bing-hamton University, State University of New York, in 2006.From 2006 to 2017, he worked as a postdoc and adjunctresearch scientist at Binghamton University. Since 2007,he has been working as a chief machine vision engineerat JADAK LLC, NY (Novanta) responsible for developingmachine vision OEM systems for healthcare automationand clinical analysis applications. His research interestsinclude machine vision and machine learning, digital im-age and video processing, and digital forensics.

Mehdi Boroumand received his B.S. degree in electricalengineering from the K. N. Toosi University of Technology,Iran, in 2004 and his M.S. degree in electrical engineeringfrom the Sahand University of Technology, Iran in 2007.From 2007 to 2013 he worked in industry at companieslike Ericsson, ZTE, and MTN. He is currently pursuinghis Ph.D. degree in Electrical Engineering at BinghamtonUniversity. His areas of research include steganography,steganalysis, digital image forensics, and machine learn-ing.

Jessica Fridrich is Distinguished Professor of Electri-cal and Computer Engineering at Binghamton University.She received her PhD in Systems Science from Bingham-ton University in 1995 and MS in Applied Mathematicsfrom Czech Technical University in Prague in 1987. Hermain interests are in steganography, steganalysis, and dig-ital image forensics. Since 1995, she has received 20 re-search grants totaling over $11 mil that lead to more than180 papers and 7 US patents.

7